dtoro/Artifacto
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Sandbox artifact rendering via iframe + CSP

Browse Source 
Splits /p/{slug} into a trusted wrapper (HTML with a sandboxed iframe)
and /p/{slug}/raw (the artifact itself, served with Content-Security-Policy:
sandbox). Artifact JS now runs in an opaque origin and can't read admin
cookies or make same-origin credentialed requests to /a/* or /api/*.
Password gating is enforced on both routes so /raw can't be used to bypass
the unlock flow.
This commit is contained in:
dtoro
2026-04-23 13:59:50 +02:00
parent 2b0ab836fe
commit 9e3443079f
3 changed files with 54 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
internal/server/templates/artifact_wrapper.html Normal file
View File

@@ -0,0 +1,18 @@
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>artifact</title>
<style>
html, body { margin: 0; padding: 0; height: 100%; background: #fff; }
iframe { display: block; width: 100%; height: 100vh; border: 0; }
</style>
</head>
<body>
<iframe sandbox="allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox allow-modals"
src="/p/{{.Slug}}/raw"
referrerpolicy="no-referrer"
title="artifact"></iframe>
</body>
</html>